The vulnerability allows an attacker to inject arbitrary client‑side scripts into pages rendered by the Blog Designer PRO plugin. By supplying malicious input that is not properly escaped, the attacker can execute JavaScript in the browser of any user who views the affected page. This can compromise user sessions, deface content, or deliver additional malware. The weakness corresponds to CWE‑79.

WordPress sites that have the solwin Blog Designer PRO plugin version 3.4.7 or earlier installed. The issue affects all releases from the earliest available pre‑3.4.8 up to and including 3.4.7.

With a CVSS score of 7.1, the flaw is considered high severity. The EPSS score of less than 1% indicates a low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is web‑based, requiring an attacker to craft a URL or form input that contains malicious code, which, when viewed by a victim, will be reflected and executed in their browser. Successful exploitation does not require authentication because the injection point is in a public page, but authenticated users are particularly at risk if the reflected content is accessed by them.